The Functional Resonance Analysis Method for a systemic risk based environmental auditing in a sinter plant: A semi-quantitative approach

Environmental Impact Assessment Review 63 (2017) 72–86

Contents lists available at ScienceDirect

Environmental Impact Assessment Review journal homepage: www.elsevier.com/locate/eiar

The Functional Resonance Analysis Method for a systemic risk based environmental auditing in a sinter plant: A semi-quantitative approach Riccardo Patriarca ⁎, Giulio Di Gravio, Francesco Costantino, Massimo Tronci Department of Mechanical and Aerospace Engineering, Sapienza University of Rome, Via Eudossiana 18, 00184 Rome, Italy

a r t i c l e

i n f o

Article history: Received 6 July 2016 Received in revised form 30 November 2016 Accepted 11 December 2016 Available online xxxx Keywords: Environmental risk Environmental audit Environmental impact assessment Functional resonance Monte Carlo simulation

a b s t r a c t Environmental auditing is a main issue for any production plant and assessing environmental performance is crucial to identify risks factors. The complexity of current plants arises from interactions among technological, human and organizational system components, which are often transient and not easily detectable. The auditing thus requires a systemic perspective, rather than focusing on individual behaviors, as emerged in recent research in the safety domain for socio-technical systems. We explore the significance of modeling the interactions of system components in everyday work, by the application of a recent systemic method, i.e. the Functional Resonance Analysis Method (FRAM), in order to define dynamically the system structure. We present also an innovative evolution of traditional FRAM following a semi-quantitative approach based on Monte Carlo simulation. This paper represents the first contribution related to the application of FRAM in the environmental context, moreover considering a consistent evolution based on Monte Carlo simulation. The case study of an environmental risk auditing in a sinter plant validates the research, showing the benefits in terms of identifying potential critical activities, related mitigating actions and comprehensive environmental monitoring indicators. © 2016 Elsevier Inc. All rights reserved.

1. Introduction Any organization that aims to control its activities generally performs environmental monitoring and auditing, to limit or prevent environmental harms. Respectively, the environmental monitoring and environmental auditing are related to the operational and the managerial status of the organization. However, in practice as well as in literature, these expressions are often used interchangeably or overlapped (Viegas et al., 2013). Monitoring focuses on stringent procedural aspects such as sampling, extraction and calibration (Rubio and Pérez-Bandito, 2009) and it consists basically on capturing, controlling and reporting a specific event while it occurs. On the other hand, auditing consists of periodically reviewing (Ruiz-Padillo et al., 2016) how policy, practices, and operations in a specific process, affect the environment, then suggesting possible mitigating actions (Thompson and Wilson, 1994). Environmental auditing acquires a risk-oriented structure (Boiral and Gendron, 2011; Knechel, 2007; Power, 2003) and thus the risk investigation aimed at risk reduction becomes one of its cornerstones (Oliveira et al., 2011). On this path, the Environmental Audit (EA) acquires a crucial role in auditing. EA is a management tool, which evaluates the environmental performance of a process plant. EA should answer several company managers' questions related to compliance with regulations, quality of practices, operational and economic level

⁎ Corresponding author at: Via Eudossiana 18, 00184 Rome, Italy. E-mail address: [email protected] (R. Patriarca).

http://dx.doi.org/10.1016/j.eiar.2016.12.002 0195-9255/© 2016 Elsevier Inc. All rights reserved.

of environmental impact (Noble and Nwanekezie, 2016), also assessing potential improvement for the plant itself (UNEP, 1990) EA has a strong risk-oriented perspective (risk-based audit – RBA) and mostly focuses on the plant's operational aspects and their impact on environmental products, especially when evaluating potential corrections of the Environmental Management System (EMS). Identifying hazards and risks is of utmost importance, in order to minimize the accidents' likelihood. RBA should focus on the environmental contribution rather than on the economic performance, differently from the existing environmental performance auditing studies (He et al., 2015). RBA analyzes agents and processes that may have an environmental impact: rather than focusing only on technical aspects of the plant, it should consider the interactions among different factors, considering the plant as a whole. This conception is particularly relevant in case of plants or processes characterized by not-negligible interactions among human, technological and organizational aspects. For a more reliable RBA, Harris et al. (2009) argued the need to include multiple causal factors, mapping more properly their causal path, especially in case of a large analysis, or in real case scenarios, with a not-negligible uncertainty (Cardenas and Halman, 2016). Evolving this idea, this paper models the interactions among system agents, adopting the Functional Resonance Analysis Method (FRAM) in order to evaluate those factors contributing to generate a potentially relevant environmental impact. In its traditional structure, FRAM defines a model showing the interactions among agents, and defining variability based on linguistic evaluations of performance. Starting from a recent explorative research in the domain of safety (Patriarca et al., 2017),

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

this paper suggests a semi-quantitative evolution of FRAM related to a detailed process. This evolution, based on Monte Carlo simulation, systematically describes how to translate the traditional linguistic characterization of performance variability into distributions of variability. Monte Carlo simulation then allows combining different aspects of variability in terms of probability distribution and subsequently, isolating critical relationships among functions. This approach would be semiquantitative since the distributions of variability are generally based on qualitative evaluations of performance, rather than quantitative data. To the best of our knowledge, this paper constitutes the first discussion of FRAM for assessing environmental risk, both in its traditional structure, and in the innovative semi-quantitative structure recently proposed in the domain of safety (Patriarca et al., 2017). The contribution of the paper are as follows. In the first section, the paper briefly summarizes the aspect of current RBA, then focusing on the benefits of developing a systemic method in line with the safety management evolution in other industrial contexts. In the second section, the paper exploits how a systemic perspective may generate benefits for traditional EA. The third section discusses the principles and the building steps of a FRAM model, detailing jointly the proposed semiquantitative structure. The fourth section details an explorative case study of a sinter plant, then discussed in terms of environmental risks by FRAM in the fifth section. Finally, the conclusions envisage the importance of this approach and pave the way to further research. 2. EA: the need for a systemic and systematic perspective EA is a tool carried out to check on existing practices, in order to assess the environmental effects of current activities (ex post). The International Chamber of Commerce (ICC) defined EA (ICC, 1991) as a “management tool comprising systematic, documented, periodic and objective evaluation of how ell environmental organization, management and equipment are performing with the aim of helping to safeguard the environment”. It started as an internal control tool, to help companies verifying their specific position with respect to environmental regulation, but nowadays it is acknowledged as an instrument leading to cost savings and management effectiveness. Following ISO 14000 family, specifically ISO 14001, EA represents a documented verification process of objectively obtaining and evaluating audit evidence to determine whether specified activities, events, conditions, management systems, or information conform with audit criteria. In this sense, EA differs from Environmental Impact Assessment (EIA), which aims to provide information as a consequence of a specific activity (ex ante) (Wathem, 1990). EA should be carried out including a kickoff meeting, detailed inspection, interviews, document review as well as closeout meeting with the plant management (Smith and Hull and Associates, 2003). Two main forces encourage the development of an EA: direct pressure, i.e. regulation and mandatory audit, and indirect pressure, i.e. the need to move towards public environmental disclosure, see (e.g.) one of the very company report, i.e. Norsk Hydro (UK) report in 1990 (Maltby, 1995). EA should then be conceived as an on-going process developing and acquiring more accurate data for improved evaluations and business performance, rather than a time-consuming process. According to an operational perspective, general guidelines about EA suggest following specific checklists related to relevant environmental parameters (e.g. emissions to air, ambient air quality, surface water quality, ground water seepage, ground water quality, etc.) (Buckley, 1991). These evaluations relate to the so-called terms of reference (TOR), which are actually confirmed to be site-specific and thus requiring the involvement of auditors with detailed knowledge of the specific industry being addressed (World Bank Group, 1998). It is possible to highlight this descriptive perspective in several industrial applications. For example, the EA program in a sugar factory of Kolhapur district of Maharashtra (India) confirms EA as a need for the company to survive in today highly regulated scenario, to prove

73

the compliance of the plant, and define measures to reduce the consumption of water and fuel (Rao et al., 2011). Similar results emerge from the EA conducted in Olkaria III, a geothermal power plant in Kenya, by the definition of a hazards list and related causal factors (Tole et al., 2009). EA of municipal solid waste management in Bangalore city shows how the values of system indicators, compared with expected values, might lead to identify process areas requiring further investigation (Ramachandra and Bachamanda, 2007). Two relevant patents have been assigned to two EA-related inventions, proving the industrial relevance of this type of audit. The patents respectively discuss a methodology for performing systematically an EA and summarizing the results in an easily understandable format based on an environmental score (Baum, 2011); and a system for managing EA information based upon a set of established safety protocols, accessible through an internetworked system (Virag and Smith, 2006). Furthermore, the Leopold matrix (LM) represents a methodology, originally intended for the EIA, but potentially helpful also for the purpose of EA (Leopold et al., 1971). LM is a two-dimensional representation, referencing activities (the rows) and existing conditions (the columns) potentially affected by them, see e.g. Josimovic et al. (2014). The benefits of this analysis are limited in case the activities are strongly linked to each other, and the environmental impact may be affected by their interactions in everyday activities, sometimes hardly to represent and describe, by system decomposition. This static representation might have limitations to highlight properly how the system actually works in normal condition, representing everyday variability and its effects on environmental outcomes. These descriptive evaluations undoubtedly help characterizing the plant and identifying which ones of a set of pre-defined indicators are critical, with respect to acceptable pre-defined levels. However, they might fall at identifying the factors leading to unacceptable values, emerging due to the complex interactions of specific processes. To fill this gap, this paper acknowledges the benefits arising from the recent research in the domain of safety for socio-technical systems, relating this innovative perspective to environmental analysis. In the safety domain, safety management is shifting from Safety-I to Safety-II, acknowledging the not-negligible complexity of current systems. Safety-I relies on the causality credo: an accident or incident happen because something goes wrong, with the possibility to find and treat its causes. However, although it is obviously reasonable that consequences are preceded by cause, it is not always correct to assume that the causes are easily detectable. This concept is even more important if considering modern industrial plants, where an increasing complexity emerges, in terms of transient interactions and tight couplings among human, technical, procedural and organization agents (EUROCONTROL, 2009; Hollnagel, 2014). We could discuss this point in terms of EA: even if it would be detectable the cause-effect links, there might be some instances where this link would become hardly identifiable, or even impossible to detect. A systemic perspective should thus be more appropriate to address current working conditions, acknowledging that they have significantly changed over the past decades. A reliable EA should thus take into account this new perspective, addressing the features of current procedures, technology, IT software, human tasks and human machine interface (HMI), organizational productivity pressures, workload effects, etc. In a modern plant, only few agents and processes are independent from each other and subsequently isolating and analyzing them in a one-by-one strategy could become ineffective. System description becomes elaborate, requiring many details, and systems may change before their description is completed. Thus, it is possible to know the principles of functioning just partly, underspecifying the whole system. These observations pave to way to the development of Safety-II (Hollnagel, 2014): - Systems cannot be decomposed in a meaningful way - System functions are not bimodal but everyday performance is flexible and variable

74

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

- Human performance variability leads to success as well as failures - Even though some outcome can be interpreted as a linear consequence of other events, some event result of coupled performance variability. Innovative systemic methods, i.e. FRAM (Hollnagel, 2012), STAMP (Leveson, 2004), aim to assess the safety characteristics of processes and systems, considered as a whole. In terms of EA, FRAM might represent a valuable solution since it represents systems by functions rather than by physical structure. FRAM enables capturing dynamics and interactions among functions by modeling non-linear dependencies and performance variability (Hollnagel, 2012). This paper shows that, once identified the system functional relationships, FRAM might enhance the EA, isolating the human actions, technical equipment or organizational factors potentially having an effect on environmental performance and guide the adoption of mitigating actions, if any. 3. The FRAM Although FRAM is a relatively recent safety assessment method, it has been widely adopted, especially in the aviation context, both for risk assessment (Herrera et al., 2010; Sawaragi et al., 2006) and for accident analysis (De Carvalho, 2011; Nouvel et al., 2007). In addition, several applications are related to different sectors, (e.g.) nuclear power plant (Lundblad and Speziali, 2008), oil refinery (Shirali et al., 2013), oil spill (Cabrera Aguilera et al., 2016), railway security (Steen and Aven, 2011). FRAM is relevant to assess critically the differences between work-as-done and work-as-imagined (Melanson and Nadeau, 2016), (e.g.) Amorim and Pereira (2015) discuss the role of improvisation at work as a source of serious accidents; Pickup et al. (2017) address the variability in blood sampling and the need for reconsidering mitigating action to enhance system resilience. Similarly, ClayWilliams et al. (2015) prove the effectiveness of FRAM in terms of reducing the need of improvisation in the healthcare domain. FRAM effectiveness in determining emergent phenomena is also discussed in simulation scenarios, in order to define command and control actions for emergence responses (Woltjer, 2008). However, based on a theoretical foundation, FRAM has been recently analyzed in terms of uncertainty modeling, showing the need to supplement its original framework with other approaches to adequately support a reliable decision-making process (Bjerga et al., 2016). For example, Zheng et al. (2016) combine FRAM with the model checker SPIN to verify several paths of variability; Rosa et al. (2015) adopted the Analytic Hierarchy Process (AHP) to reduce the subjectivity in the evaluation of FRAM variability. Praetorius et al. (2016) combine FRAM with Formal Safety Assessment (FSA), a structured methodology in maritime safety rule making process, proving the potential benefits in hazard identification. Patriarca et al. (2017) define a theoretical framework for a systematic evaluation of variability, concluded by a very conceptual illustrative case study. Once identified functional variability, a FRAM model would be helpful assessing critical functions, for example by specific questionnaires to sharp-end and blunt-end operators (Albery et al., 2016).

resultant from a specific combination of fixed conditions. Some events emerge due to particular combination of time and space conditions, which could be transient, not leaving any traces. • Functional resonance: The functional resonance represents the detectable signal emerging from multiple signals interacting in unintended ways. This resonance is not completely stochastic, because the signals variability is not completely random but it is subject to certain regularities, i.e. recognizable short cut or heuristic, that characterize different types of functions.

3.2. The FRAM building steps Hollnagel (2012) defined four steps to perform a FRAM analysis. Before starting the analysis, it is necessary to clarify the scope of the analysis, i.e. risk assessment or accident analysis, following the so-called step 0. For the purpose of this paper, it is relevant only to discuss about the risk assessment, as part of the auditing process. 3.2.1. Step 1: identification and description of system's functions A FRAM function represents the activities required to produce a certain outcome. Six different aspects can characterize each function: • Input (I): what starts the function or what is processed or transformed by the function. • Output (O): the result of the function, it can be either an entity or a state change and serves as input to the downstream functions. • Precondition (P): mandatory conditions that must exist before carrying out the function. Preconditions do not necessarily imply the function execution. • Resource (R): that which the function need when it is carried out or consumes to produce the output. • Control (C): that which controls and monitors the function, regulating its performance to match the desired Output. • Time (T): temporal constraints of the function, with regard to both duration and time of execution.

Functions aim describing daily system work. Their identification might be based on different techniques, (e.g.) interviews to sharp-end and blunt-end operators, Hierarchical Task Analysis (HTA) (Stanton, 2006), Function Analysis System Technique (FAST) (Kaufman and Woodhead, 2006), Cognitive Task Analysis (CTA) (Hollnagel and Woods, 1983), Structured analysis and design technique (SADT) (Ross, 1985). Nevertheless, analyzing the system functioning in terms of the six aspects (I, O, P, R, T, C), which are generally placed at the corners of a hexagon (see Fig. 1), shall guide the identification of functions and relationships among functions. It is possible to distinguish functions in two classes: foreground and background. The background functions

3.1. The FRAM principles The four principles of FRAM are (Hollnagel, 2012): • Equivalence of failures and successes. Failures and successes come from the same origin, i.e. everyday work variability. This latter allows both things go right, working as they should, and things go wrong. • Principle of approximate adjustments. People as individuals or as a group and organizations adjust their everyday performance to match the partly intractable and underspecified working conditions of the large-scale socio-technical systems. • Principle of emergence. It is not possible to identify the causes of any specific safety event. Many events appear to be emergent rather than

Fig. 1. Graphical representation of a FRAM function.

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

represent the components not detailed in the FRAM analysis and therefore they have only outputs. The foreground functions represent the core of the analysis and thus they require a more detailed definition, potentially with respect to all the six aspects. 3.2.2. Step 2: identification of performance variability Performance variability characterizes each FRAM function: it permits to understand functions potential couplings and how the consequent unexpected outcomes. The functions' variability has to be defined accurately. A widely used description of variability reflects a common distinction of functions in technological, human and organizational. The technological functions represent the machineries' work and, for this reason, their variability is generally considered low and negligible. Due to particular conditions, some technology functions may have a greater variability, (e.g.) sensors subjected to unexpected temperature conditions, machineries with inadequate maintenance. The technological variability reflects the probability of failure of the specific machinery. On the other hand, human functions consist of the actions taken by an individual or a small group of individuals. Differently from technological functions, human functions change rapidly, with high frequency and high amplitude of potential performance changes. The changes generally depend on physiological, psychological and working conditions. Lastly, organizational functions differ from human functions because they are functions of the system per se, rather than of the people who work in the system. Their variability is low in frequency but high in amplitude. This concept is in line with the low frequency of changes, for example about rules, regulations or policies, which however foresee big differences in the change (and thus a high amplitude). Hollnagel (2012) classifies the different causes of performance variability in endogenous and exogenous, according to the variability's etiology, and defined the importance with different variability manifestation, the so-called phenotypes: from the simple solution considering only two phenotypes, i.e. timing and precision, to the more elaborate ones adopting multiple phenotypes, i.e. speed, distance, sequence, object, force, duration, direction, timing (Hollnagel, 2012). In this paper we will evaluate the so-called simple solution, only identifying timing and precision as variability phenotypes for system' functions. According to this choice, an output can occur (e.g.) too early, on time, too late or not at all. “Not at all” represents the possibility that an output is produced too late that it is useless for its purposes or even not produced at all. In this case, rather than adjustments, the downstream function requires improvisation, amplifying the function variability. In terms of precision, an output can be precise, acceptable, imprecise or wrong. If the output is precise, it satisfies entirely the needs of its downstream function. If it is acceptable, it requires some adjustment in the downstream function, even bigger in case it is imprecise. We consider the possibility of assigning a numerical score to each performance variability state, besides the traditional linguistic definition (Patriarca et al., 2017). It is thus necessary to define a deterministic rating scale, which express the effects on performance of a function's variability. The Subject Matter Experts (SMEs) involved in the study assign the numerical scores according to the process specific requirements, as shown (e.g.) in Table 1, translating the qualitative judgments into semi-quantitative ones. The higher the score, the more critical the output variability. Table 1 Variability score with respect to time and precision. Variability Timing

Precision

Too early On time Too late Not at all Precise Acceptable Imprecise

The variability of the upstream output j, OVj is the product of these two scores (Eq. (1)): OV j ¼ V Tj ∙V Pj

ð1Þ

where: VTj represents the score of the upstream output j score in terms of timing VPj represents the score of the upstream output j score in terms of precision. In a practical sense, however, one of the main issues in defining the variability scores for each function arises from the awareness that a static behavior for a system component may not reflect adequately the real case situation. For example, even though an instrument output is generally precise and on time, it may have rare unpredictable errors and delay on transmissions, resulting thus in an imprecise and/or too late output. This concept is even more important in case of organizational or human functions, based on the variability of everyday performance. Sometimes it may be difficult, or even wrong, to define a static level score. The auditing process, however may help in detailing the variability of each function, evaluating the work as done. However, it would be possible to define some typical functions' behaviors, using the classification in technological, human and organizational functions, as shown in Hollnagel (2012). Fig. 2 shows a possible set of discrete distributions, which will be specialized and modified by the auditing process' outcomes. Monte Carlo simulation allows translating the scalar product in Eq. (1) into a discrete probability distribution, propagating the uncertainties in VTj and VPj into uncertainties in OVij. 3.2.3. Step 3: aggregation of variability This step focuses on examining how the potential variability of each function can become resonant and lead to unexpected results, according to the functional resonance principle for each upstream-downstream coupling. The variability of a function results as a combination of the function variability and the variability deriving from the outputs of the upstream functions, depending on the function type and the linked aspects' type. For a generic function, it is possible to define qualitatively the effects of a coupling. For example, an upstream output that represents a precondition for the downstream function may cause a loss of time if it arrives too late, and then amplify variability. On the other hand, the same output may damp the variability, if on time, or may result in a false start and amplify variability, if too early. Also in terms of precision, the same output may cause misunderstanding and amplify variability, if imprecise or even it may cause a loss of time to eliminate potential disambiguation. In line with Eq. (1), it is possible to sketch the damping or amplifying effects of each coupling by a specific index for timing and precision, defining the Coupling Variability CVij of the upstream output j and the downstream function i, as Eq. (2): CV ij ¼ OV j ∙aTij ∙aPij

ð2Þ

where: aTij represents the amplifying factor for the upstream output j and the downstream function i, in terms of timing aPij represents the amplifying factor for the upstream output j and the downstream function i, in terms of precision. Note that aTij (or aPij) may assume the following values Eq. (3):

Score 2 1 3 4 1 2 4

75

aTij ¼

8 < 2 1 : 0; 5

in case the upstream output has an amplyfing effect on the downstream function in case the upstream output has no effect on the downstream function in case the upstream output has a damping effect on the downstream function

ð3Þ The values assigned to aTij (and aPij) have to be based on SMEs' opinions for each specific upstream/downstream coupling, also following the qualitative structure defined in Chapter 7 of Hollnagel (2012).

76

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

Fig. 2. Probability distribution of technological, human and organizational functions in terms of timing and precision.

3.2.4. Step 4: managing the variability The purpose of this last step consists of monitoring and managing the performance variability. Performance variability can lead both to positive and negative outcomes. The most fruitful strategy consists of amplifying the positive effects, i.e. facilitating their happening without losing control of the activities, and damping the negative effects, eliminating and preventing their happening. Once identified the critical couplings, FRAM helps identifying dampening actions and thus potential changes to the process, involving people, organization or instruments, in order to prevent from harmful environmental situations. The strategy suggested in this paper for isolating critical couplings consists of filtering them by a threshold CV⁎ and a confidence level P⁎, and then defining critical only the couplings whose cumulative distribution over the threshold is lower than (1− P⁎). This classification defines priorities for the mitigating actions. In addition, rather than simple independent critical couplings, the analysis highlights critical paths in case other critical couplings, backwards or afterwards, link the same functions. The functional resonance emerges, in this sense, relating multiple upstream-downstream functions of the process.

4. The sinter plant This section sketches the outcomes of a FRAM application, in its evolved formulation, to identify environmental risks of a sinter plant and then individuate priorities for mitigating actions. The plant under RBA is a blast furnace/basic oxygen furnace (BF/ BOF). BF/BOF is the most complex steelmaking process, taking place in an integrated steelworks (Stahl, 2008). In such a large industrial complex, the various production units are connected by networks of interdependent material and energy flows. The input materials i.e. sinter, iron pellets, limestone and cokes, enter a Blast Furnace (BF) to be converted into molten pig iron, as sketched in Fig. 3. The pig iron is then loaded into an oxygen furnace to produce steel slabs (Van Wortswinkel and Nijs, 2010). The pellet and the sinter plants are two different types of iron ore's preparation plants for the BF's burden. Pellets are generally made

from one well-defined iron ore or concentrate at the mine and are transported in this form. Therefore, the steelworks generally do not include the pellet plant. On the other hand, sinter is produced at the steelwork site from pre-designed mixtures of fine ores, residues and additives. Globally, the iron and steel industry has a relevant flow of materials and energy. Generally a portion of 57% crude steel is produced from the input materials (e.g. fuels, additives, lime, limestone, coal, scrap, iron ore), with 43% of residues (e.g. solid production residues, off-gases, and process gases). In particular, the sinter plant has a crucial role in terms of emissions of the steelwork (up to 50% of the total dust). There are also SO2, HCl, HF, PAH, persistent organic pollutants (e.g. PGB and PCDD/F) and heavy metals in the off-gas emissions from the sinter strand and the cooler. In addition, the utilisation of solid wastes and the recovery of sensible heat are severe issues for the process. 4.1. The phases of the process The sinter plant under RBA adopts the down draft sintering on continuous travelling grates, as detailed by EU BREF for Iron and Steel Production (Remus et al., 2013). Here follows the main production phases of the process. - Raw materials preparation: These materials are iron ore fines, fuel, fluxes, return fines of the sinter plant and in-plant metallurgical waste materials. For the audited plant the coke breeze, i.e. coke with diameter less than 5 mm, is considered as an output of external activities. - Mixing: A rotating drum mixes the raw materials, the coke breeze and water (according to precise proportion) in order to obtain a proper agglomeration, in the form of micro-pellets. - Sinter strand: The sinter machine receives the micro-pallets of the raw mix, which is levelled over a layer of controlled size sinter of 30–50 mm, i.e. the hearth layer. This latter prevents the mix passing through the grate, and ensures the grate's protection from the high temperature of the mix, once ignited. Once levelled, by gas (or oil) burners, the surface of the mix is ignited. At this step, it ii necessary to ensure the “burn through” (i.e. the point at which the burning fuel layer reaches the base of the strand) occurs just prior to the sinter

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

77

Fig. 3. Main processes in the iron and steel making process.

discharging point, controlling sinter machine velocity and gas flow. - Hot crushing: At the end of the machine, the sintered cake is discharged into the roll crusher to a maximum particle size. - Hot screening: The screening process separates pellets whose size is

less than 5 mm, recycling them to feed the starting raw mix. - Cooling: The sinter is discharged onto a circular sinter cooler, whose diameter is 25 m. The sinter layer's height is approximately 1 m and it is cooled by air.

Fig. 4. Representation of the material flows and control points in the plant under RBA.

78

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

Fig. 5. Mass stream of a sinter plant (Remus et al., 2013).

- Cold screening: Based on the particle size, the cold screening filters separates the product sinter (5–50 mm), bedding (10–20 mm) and return fines (0–5 mm), which are conveyed to a recycling bin if not suitable for downstream processing.

Fig. 4 shows the material flow of the sinter plant. The stacks indicate the emission sources, and the C1–C14 indicate the position of the monitoring and control actions in the plant. 4.2. Main equipment Here follows a synthetic overview of the plant's main equipment: - Raw material bins: These bins contain the mixed materials that will feed the mixing drum. There are 6 types of storage bins (SBs): ○ ○ ○ ○ ○ ○

SB#1 for the iron ore SB#2 for the coke SB#3 for the flux materials SB#4 for the return fines SB#5 for the additives SB#6 for the in-plant metallurgical waste materials

- Raw material weigh feeders: Charging machineries with an integrated weighting system that ensures a continuous weighting process for the materials that will feed the mixing drum. - Mixing drum with water injection system: The mixing drum includes also an injection system that adds the optimal proportion of water to ensure the specific humidity of the mix. - Ignition hood furnace with burners: The burners start the sintering process in the sintering machine. - Spike crusher with crash deck: This machinery crushes the sinter

after the sinter strand operation. - Vibratory hot and cold screens. Filters for the hot and cold sintering based on the vibrating screen technology. - Cooler: A rotating cooler with a diameter of 25 m. - Conveyors: Conveyors chutes and transfer chutes for raw materials and sinter - Weigh hoppers: The hoppers ensure a continuous weighting process for the materials that will fed the sintering machine. - Waste gas fans and dedusting fans: These fans have also a dedusting system, which filter the off-gases. - Electro Static Precipitator (ESP): A dry ESP for the particulate collection. This latter, based on the electrostatic attraction, requires specific maintenance activities to remove the particulate accumulated in the collection electrode.

4.3. Operators Human operators working in the plants have four different roles. In particular: - Raw materials charging operators: These operators are responsible for the charge of the materials in the mixing process. There are blend charging operators, flux material operators, crushed coke charging operators, return fines operators, additives charging operators, waste materials charging operators. - Sintering grate operators: These operators are responsible for the operation control of the sintering machine. - Shredding workers: These operators are responsible for the operation control of the sinter crushing. - Sintering process engineers and supervisors: These operators are the

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

engineers and the main supervisors of the whole process. They act in all the phases of the process, according to specific needs.

Table 3 List of FRAM functions and relative descriptions. Name of function Blend ore beds

4.4. Control points The monitoring points are located following the positions shown in Fig. 4. Specifically: - C1 - Raw mix composition monitoring point: Producing the right raw materials' composition is a complex activity that has to take into account different variables. In this case, the mix composition is varied by an IT system, to obtaining ensure the target values for specific variables (e.g., sinter basicity, Fe, MgO, SiO2 content). - C2 - Flow monitoring point for the ore bed stacking: This monitoring point evaluates a stacking plan for blending ore beds, relying on the calculation of the raw mix. The model calculates the material flow rate during stacking in order to obtain a homogenous blending ore bed, auto-compensating potential deviations. - C3 - Ore bed geometry monitoring point: The point defines a 3D model of the ore bed to compare it to the desired one and to modify the raw composition. It works in the offline mode (geometry calculated on the stacking plan) or in the online mode (geometry calculated on real data derived from sensors). - C4 - Hoppers' feeding speed monitoring point: Automatically regulated according to the M6. - C5 - Mixing drum's humidity monitoring point: This monitoring point influences the water injection system, in order to ensure the right specific humidity. - C6 - Hopper level monitoring point: The height of the hopper level is maintained constant according to the raw materials' feed rate. The level regulates by changing the speed of the feeding roll, by the action in M4. - C7 - Ignition hood temperature monitoring point: This monitoring point allows feeding the ratio setpoint trim input of the gas controller by the hood temperature controller. - C8 - Ignition hood pressure monitoring point: This monitoring point ensures a fixed pressure in the ignition hood, by modifying the dampers' settings in the windboxes, by a single loop PID controller. - C9 - Calorific value of ignition hood fuel gas monitoring point: A separate control loop maintains the calorific value of the fuel to a consistent value. In case the strand stops, the ignition hood swaps into a “low fire state” and hold it there until the strand restarts, by a digital signal. - C10 - Suction temperature monitoring point: Several thermic sensors control the temperature in the suction pipe. - C11 - Burn-through point (BTP) monitoring point: The strand speed

Table 2 Example of a FRAM function. Name of function

Calculate stacking for ore bed blending

Description

The model calculates a stacking plan for blending ore beds based on the raw mix composition calculated by the corresponding raw mix calculation Technological

Function type Time var. Precision var. Aspect

Description of aspect

Input

Blending raw materials availability Adequate raw mix composition Stacking plan for blending

Output Precondition Resource Control Time

SIMETAL Stacking Plan Model

79

Description

Layer iron ores and other elements (flux material, recycled iron-bearing material and additives) on prepared areas to form the ore beds Calculate stacking for ore bed The model calculates a stacking plan for blending blending ore beds based on the raw mix composition calculated by the corresponding raw mix calculation Calculate geometry of ore beds The model simulates the 3D geometry of the blending ore bed by calculating the volume of the material mixture for each stacking step Calculate raw mix composition The model establishes an adequate raw mix composition in order to automatically achieve the assigned values for specified variables Provide materials information Provide useful data about the characteristics of raw materials. Technical function provided by plant databases Plan sinter target quality Establish the target quality of the final product in terms of chemical and physical properties Transfer ore blend to storage bins Transfer the ore blend from the beds to the assigned storage bins (bins 1) at the start of the sinter plant Transfer coke to crusher Transfer coke, delivered by external suppliers, from coke beds to coke crusher Crush coke Crush coke in order to obtain coke fines with particles size less than 5 mm (coke breeze) Roll crusher maintenance Keep the roll crusher in good condition Collect and purify gas from coke Collect off gas from the stack corresponding to crushing and coke transfer the coke crushing stage. The emissions are abated by the evacuation of dust and subsequent purification of collected gas Transfer coke breeze to storage Transfer coke breeze from the crusher to the bins assigned storage bins (bins 2) at the start of the sinter plant Transfer coke to bf Transfer the oversized fraction of crushed coke to the Blast Furnace Transfer limestone fines to storage Transfer limestone fines (particles size less bins than 3 mm) to the assigned storage bins (bins 3) at the stat of the sinter plant Transfer return fines to storage Transfer return fines from hot screening and bins return fines from Blast Furnace to the assigned storage bins (bins 4) at the start of the sinter plant Transfer additives to storage bins Transfer other additives (olivine, dolomite, etc.) to the assigned storage bins (bins 5) at the start of the sinter plant Transfer waste materials to Transfer iron-bearing waste materials (dust storage bins and sludge from BF gas cleaning, dust from off gas de-dusting) to the assigned storage bins (bins 6) at the start of the plant Purchase materials and monitor Purchase raw materials from external availability suppliers and monitor the availability of each Transfer raw materials to mixing Transfer raw materials from the storage bins drum to the mixing drum through weigh feeder conveyors Control raw materials feed rate Adjust input feed rate of raw materials in order to control the material level in the hopper of the mixing drum Mix materials Blend raw materials and dampen the mixture to enhance the formation of micro-pellets, which improve the permeability of the sinter bed Mixing drum maintenance Keep the mixing drum in good condition Manage water supply Control the moisture content in the mixture through moisture measurement and feed-water flow control in order to attain specified moisture in the mixture Collect and purify gas from Collect off gas from the stack corresponding to blending & mixing the blending and mixing stage. The emissions are abated by the evacuation of dust and subsequent purification of collected gas Control hopper level The model controls the hopper level in order to have an adequate thickness of the sinter strand. The hopper level is modified by

80

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

Table 3 (continued) Name of function

Table 3 (continued) Description

adjusting input feed rate of raw materials Signal “sinter feed” Signal “sinter feed” to start the layering of mixture to sinter on the grate Place heart layer Place a bottom layer of recycled sinter on the grate. This bottom layer prevents the mixture from passing through the slots of the grate and protects the grate from direct heat of the burning mixture Place material to sinter on the Place the material to be sintered on the top of heart layer the heart layer Ignite coke breeze in the mixture At the start of the grate, ignite the coke breeze in the mixture with a canopy of gas burners Control ignition furnace Control the temperature of ignition furnace by temperature, pressure and hood adjusting ratio of mixed gas and combustion air, the pressure and the ignition hood of the furnace BTP control Control sinter strand speed in order to position the Burn Through Point close to the end of the strand Fine particles sintering As the sinter mixture proceeds along the grate, the combustion front is drawn downwards through the mixture. This creates sufficient heat to sinter the fine particles together into porous clinker Sintering machine maintenance Keep the sintering machine in good condition De-dust gas from sinter strand Collect off gas from the stack corresponding to the sintering stage. De-dust gas collected from the emission point associated to the sintering machine with a traditional electrostatic precipitator Monitor emissions from sinter Collect data about air emissions strand (concentration of pollutants) from sinter strand Collect solid emissions Collect all solid emissions of the plant in storage bins for future disposal Discharge sinter cake Discharge sinter cake from the sintering machine to the crusher Crush the sinter cake Crush the sinter in a roll crusher Collect and purify gas from hot Collect gas from the stack corresponding to sinter crusher and sinter the hot sinter crushing stage. The emissions transfer are abated by the evacuation of dust and subsequent purification of collected gas Screen hot sinter After crushing, screen sinter in order to separate hot return fines (size less than 5 mm) from acceptable hot sinter (size more than 5 mm) Cool sinter Cool sinter by air forced upwards or downwards through the layer of material in the cooler Control cooler speed Control the speed of the rotating cooler Rotating cooler maintenance Keep the rotating cooler in good condition Screen cold sinter After cooling, screen the cold sinter in order to separate acceptable cold sinter for the Blast furnace (size more than 5 mm) from pieces to be returned to the sinter process Screen maintenance Keep the hot screen and the cold screen in good condition Move sinter to bf Transfer acceptable cold sinter to the Blast Furnace bunkers Collect and threat water Collect water to threat (washing water from wet cleaning of locals, cooling water from sintering machine cooling and ESP discharge water) Collect and purify gas from Collect off gas from the stack corresponding to cooling the sinter cooling stage. The emissions are abated by the evacuation of dust and subsequent purification of collected gas Remove dust from locals Periodically remove dust deposition on the plant premises in order to prevent runoff to surface water. If plant uses wet cleaning techniques, washing water must be threated before discharge Provide SIMETAL software SIMETAL Sinter VA-iron is an advanced package process optimization system, which covers the sinter production process. A number of process models are available in the VA-iron

Name of function Blast furnace and coke oven operations

ESP maintenance Manage HR

Raw materials charging management and supervision Sinter strand operations management and supervision Shredding management and supervision

Description Sinter automation package Background function representing the flow of materials and gas from downstream operations (from coke oven plant and from blast furnace). Being out of scope, this function is assumed as not variable Make the electrostatic precipitator of the plant correctly working Manage human resources. Workers are essentially divided into 4 groups: raw materials charging workers, sintering grate workers, sintering process engineers and supervisors Human activities needed to ensure that raw materials charging takes place in a proper way Human activities needed to ensure that sinter strand operation take place in a proper way Human activities needed to ensure that shredding operations (sinter crushing) take place in a proper way

is modified in order to ensure that the BTP is located as near as possible to the end of the strand bed. In case the BTP occurs too early the speed strand is increased, and vice versa. - C12 – Sinter cake monitoring point: A shredding operator control the sinter cake operational parameters and compares them to the specific values. - C13 - Cooler speed monitoring point: This monitoring point ensures the cooler rotates at the speed which ensures matching the strand demand defined by the bed depth and the strand speed. - C14 - Emissions monitoring point: This point monitors the emission of the main waste gas stack, the one related to the sinter strand.

4.5. Emissions Fig. 5 presents a schematic overview of material flows in a sinter plant, focusing on its emissions. This section describes their relationship with the plant, since the research in this paper aims to identify the functions having a crucial role in terms of emissions' level. The most significant (Remus et al., 2013) air emissions of a sinter plant are: - Off-gas emissions from the sinter strand. Several common features characterize the waste gas extracted from windboxes, such as typical emissions profiles of CO2, CO, O2 and H2O. In detail: ○ Dust, including the coarse dust (grain size of about 100 μm) and the PM1. ○ Heavy metals, causing significant heavy metal emissions, especially for lead, but also for mercury and zinc. ○ Alkali chlorides, whose formation has a negative impact on ESP removal efficiency. ○ Sulphur oxides, mainly SO2, originating from the combustion of sulphur compounds in the sinter feed through the coke breeze and the iron ore. ○ Fluorides. ○ Nitrogen oxides. ○ Other inorganic compounds, mainly HCN. ○ Hydrocarbons, mainly due to incomplete combustion of carbonbearing raw materials. ○ Polychlorinated dibenzo-p-dioxins and furans (PCCD/F), whose formation is a complex process, due to several contributions at different positions. ○ Polychlorinated Biphenyls (PCB), whose formation is similar to the PCCD/F's one. ○ Polycyclic aromatic and hydrocarbons (PAH), due to the not homogenous and incomplete combustion for the sinter bed.

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

81

Fig. 6. FRAM Mind Map of the sinter plant under RBA.

○ Plumes, i.e. visible smoke originating from exhaust gas from iron ore sintering plant. - Dust emissions from sinter cooling, which is originated at the cooler, if not fully covered - Dust emissions from the main operation (handling, crushing, screening and conveying) of sinter products. In addition for the water waste: - Rinsing water, treated by sedimentation in the recirculation circuit. - Cooling water, for ignition hoods, fans and sinter machines. - Waste water from waste gas treatment, due to the wet abatement system.

Table 4 Example of a FRAM function with variability exploited. Name of function

Calculate stacking for ore bed blending

Description

Based on raw mix composition, this model evaluates a stacking plan for blending ore beds. Technological

Function type

Time var.

Precision var.

Aspect

Description of aspect

Input Output Precondition Resource Control Time

Blending raw materials availability Stacking plan for blending Adequate raw mix composition SIMETAL Stacking Plan Model (Not analyzed) (Not analyzed)

Besides the environmental factors yet described, it is necessary to consider also the process residues, the energy consumption and the noise generated by fans and crushing operations. 5. FRAM for analyzing the environmental risks of a sinter plant This section defines the steps required to apply FRAM in a systemic analysis of the environmental RBA in a sinter plant. The section follows the traditional FRAM steps and their evolution, as shown in Sections 3.2.2, 3.2.3 and 3.2.4. 5.1. Step 0: environmental risk assessment The method follows a systemic approach to assess potential environmental risk factors of the sinter plant. It considers how the variability of normal work may affect the plant emissions, individuating potential critical functions. Following the traditional terminology, it is a FRAM for risk assessment, newly applied following an environmental perspective. For the purpose of the study, we develop the FRAM model taking advantage of three SMEs, both to confirm the significance of the identified functions of Section 5.2, and to define the criticality score for each function in Section 5.3. 5.2. Step 1: function identification for the sinter plant This section offers an outline of the FRAM functions, according to the description in Section 4, with particular reference to phases of the process in Section 4.1, the operators responsibilities in Section 4.2, the machineries in Section 4.3, the control points in Section 4.4 and the emission characteristics in Section 4.5. The FRAM model consists of 56 functions, which describe the system structure and aim at evaluating how normal work affects the environmental aspects. The list of the functions derives from authors' experience on the field and the analysis of actual processes, based on Hierarchical Task Analysis (HTA) (Stanton, 2006), as discussed in the FRAM handbook (Hollnagel, 2012). The list of functions has been revised in agreement with three SMEs, interviewed in order to limit as much as possible the deviations between the model and the actual functioning of the system. It is relevant to observe how the following functions describe everyday work, in normal condition, rather than failure probabilities. Each function is described in the six aspects of FRAM, as in Section 3.2.1 and shown in the example function in Table 2. Table 3 sketches all the 56 functions and the relative descriptions, graphically represented in Fig. 6.

82

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

Table 5 Example of an aggregation of upstream/downstream functions. Downstream function

Upstream function

Amplifying factor aTij

aPij

Blending raw materials availability

1

2

Pre-condition Calculate raw mix composition

Adequate raw mix composition

1

1

Resource

SIMETAL Stacking Plan Model

1

0,5

Name of function

Aspect

Name of function

Description of aspect

Calculate stacking for ore bed blending

Input

Purchase materials and monitor availability

Provide SIMETAL software package

VTj

VPj

5.3. Step 2: identify the functions' variability

5.4. Step 3: aggregation of variability

Following the process described in Section 3.2.2, once classified the functions according to their type, i.e. human, technological and organizational, it is necessary to define each function's variability in terms of timing and precision, and assign then the relative score, which will be translated in a probabilistic distribution function, as shown in Fig. 2. This phase of the study relies on the judgments by the same SMEs involved in verifying the appropriateness of the model, interviewed to define the variability of each output. The SMEs suggested some specific probability distributions to output which required different shapes. The scores, specific for each function, range from 1 (minimum criticality) to 4 (maximum criticality), confirming the example in Table 1. Table 4 shows an application of variability for the same function shown in Table 2.

Table 5 shows an example of the amplifying factors applied to three inputs, i.e. Input, Precondition, Resource, of the function in Table 2. 5.5. Step 4: managing the variability For the plant under environmental RBA, it seems meaningful to accept variability until (e.g.) the upstream output is too early, with no effect on the downstream function aTij = 1, and acceptable in terms of variability, with an amplification aPij = 2, or any other combination which leads to assign a threshold CV⁎ = 4 (considering a 95% confidence level). Thus, a coupling is considered critical only if the cumulative distribution of CVij over 4 is major than 0.05. In a conservative approach, we decide to run 1000 iterations for the Monte Carlo analysis.

Fig. 7. A critical path emerging from the development of semi-quantitative FRAM.

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

83

Fig. 8. Other critical paths emerging from the application of semi-quantitative FRAM.

Once identified the critical couplings and paths, including two or more functions, linked by one or more critical couplings, the last step of FRAM aims to reduce their variability, providing guidelines for

identifying the proper mitigating actions. Fig. 7 shows an example of one of the critical paths emerged from the analysis. As a specific consequence, based on this result, it would be possible to suggest a mitigating

84

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

Fig. 9. Traditional EA and semi-quantitative FRAM applied to EA (the green boxes highlights the differences in the process). (For interpretation of the references to color in this figure legend, the reader is referred to the web version of this article.)

action consisting of substituting partially the coke breeze with the anthracite, which is cheap and has a low volatile matter content, reducing thus the emissions of hydrocarbons. In addition, the BATC (EU Commission, 2012) suggests several techniques for the prevention of dust releases related to the bulk raw materials' handling and transport. The more suitable ones for the audited sinter plant consist of (e.g.): - Limiting the drop heights to a maximum of 0,5 m - Using recycled water sprays for dust suppression - Covering the surface with coating stockpiles (i.e. latex).

Fig. 8 shows the other 6 critical paths identified for the audited plant. An in-depth analysis of each coupling should allow defining other mitigating actions, and the adoption of specific mitigating techniques to mitigate the environmental risks. 5.6. Discussion of the results This section aims to define how the semi-quantitative framework developed here is related to traditional EA and which enhancement it might offer for future analyses. Traditional EA aims to develop a descriptive framework of environmental performance, relying on real data. Since 1980, a strong interest in EA directed towards improving techniques for the purpose of EA and EIA, in terms of quantitative indicators, which however fall to properly represent the system state (Tomlinson and Atkinson, 1987). As discussed in Section 2, it is possible to relies on several checklists to select (and adapt, if necessary) the indicators to be investigated for a specific system, relying on system characteristics. Based on the analysis of the system, these indicators might lead to mitigating actions, if any, when compared with standards, or target values (as shown in Fig. 9A). More recently, Toro et al. (2012) show how environmental indicators might be considered in terms of vulnerability, reducing the effects of uncertainty by qualitative and quantitative measurements (Toro et al., 2012). On the same path, a recent study confirms the crucial role of uncertainty in

environmental estimation of the system parameters (Cardenas and Halman, 2016). This study points out some potential aspects to improve to develop a reliable audit or assessment, with strong decision-making implications. The study suggests using structured multi-expert elicitation processes, in order to limit subjectivity on judgments, as also confirmed by Wessels et al. (2015). In addition, the study suggests developing audit capable of addressing multidimensional characterization of impacts, providing input that can be used to define management actions. Furthermore, the study defines essential to comprehensively consider the interactions among impacting factors, to avoid unjustified personal judgments, and allow comprehensive and sensitive monitoring. The semi-quantitative FRAM framework allows a different perspective. Acknowledging the centrality of system functioning and everyday work (step 1, Section 3.2.1), it requires to assess performance variability of the system functioning (following step 2, Section 3.2.2 and step 3, Section 3.2.3). Then, combining the developed FRAM model with the traditional EA checklist, it would be possible to obtain more detailed indicators to assess in order to define more properly mitigating actions (relying on step 4 of the method, Section 3.2.4). In parallel, other process indicators (not strictly related to environmental purposes) would be helpful to feed the Monte Carlo model of performance variability (as shown in Fig. 9B). This perspective appears reproducible in different contexts, and able to enhance standard analyses, also in line with the recently suggested research paths in terms of environmental analysis, i.e. modeling interactions among impacts, undertaking comprehensive and sensitive monitoring, characterizing impact in terms of different dimensions (Cardenas and Halman, 2016). Furthermore, the FRAM model would help enhancing organizational learning and defining prospective analysis, also following EIA.

6. Discussion and conclusions FRAM allows a systematic analysis of a process or a system, in order to have a clear description of system functions and their interactions in a

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

systemic perspective. The inherent functional nature of FRAM allows identifying static and transient links between human, organization, and technological agents, since it describes the normal functioning of the system. The approach proposed in this paper represents the first application of FRAM for the purpose of environmental risks, showing also an evolution of the traditional FRAM qualitative structure by a semiquantitative approach. The case study shows the potentiality of FRAM in terms of identifying critical functional paths, obtained combining transient and volatile systems' couplings and interactions among activities. The critical paths suggest where the functional resonance may arise, emerging from system complexity, and potentially not leaving any traces if analyzed with traditional risk assessment techniques. This explorative study might be enhanced following different perspectives. According to a modeling point of view, our solution reflects the variability descriptions in terms of two phenotypes, i.e. time and precision. In terms of future research, this perspective might be evolved following all the phenotypes' characteristics to have a wider description of variability, for example following the six phenotypes theoretically described in Hollnagel (2012) and conceptually discussed in Patriarca et al. (2016). It would be even possible to identify the scenarios' variability, in order to model other real case situations and external variability (Patriarca et al., 2017). In terms of future applications, these outcomes might be enhanced considering an iterative procedure to feed the Monte Carlo simulation model. More specifically, once identified the criticalities of the process, it would be useful to define specific measurement criteria for those highlighted outputs, substituting the distribution based on SMEs' judgements with real data. An iterative simulation would thus allow a more accurate assessment. Furthermore, based on the outcomes of this prospective study, it would become significant, for the measured outputs, to compare the actual distribution of variability to the estimated ones and adjust the confidence level of the analysis for the other functions (in this study set at 95%, see Section 5.5). The promising outcomes of this paper highlight the possibility of adapting this semi-quantitative FRAM for RBA of different process plants, where high system complexity requires a systemic approach for adequately assessing environmental impacts and ensuring thus a more sustainable production. Acknowledgments The authors acknowledge Isabelle Pietroletti for her precious work in supporting the development of the case study and the anonymous referees for their valuable suggestions to improve the quality of the paper. The authors developed a VBA code to execute the semi-quantitative analysis conducted in this study and they interface it with the FRAM Model Visualizer (FMV), a software based on the method designed by prof. Erik Hollnagel, and written and developed by Rees Hill, which the authors greatly acknowledge. References Albery, S., Borys, D., Tepe, S., 2016. Advantages for risk assessment: evaluating learnings from question sets inspired by the FRAM and the risk matrix in a manufacturing environment. Saf. Sci. 89:180–189. http://dx.doi.org/10.1016/j.ssci.2016.06.005. Amorim, A.G., Pereira, C.M.N.A., 2015. Improvisation at workplace and accident causation - an exploratory study. Procedia Manuf. 3:1804–1811. http://dx.doi.org/10.1016/j. promfg.2015.07.219. Baum, D.T., 2011. Environmental Audit Method. US 2011/0004544 A1. doi:US 2010/ 0311130 Al Bjerga, T., Aven, T., Zio, E., 2016. Uncertainty treatment in risk analysis of complex systems: the cases of STAMP and FRAM. Reliab. Eng. Syst. Saf. 156. http://dx.doi.org/ 10.1016/j.ress.2016.08.004. Boiral, O., Gendron, Y., 2011. Sustainable development and certification practices: lessons learned and prospects. Bus. Strateg. Environ. 20, 331–347. Buckley, R., 1991. Guidelines for Environmental Audit. In: Buckley, R. (Ed.), Perspectives in Environmental Audit. Springer Berlin Heidelberg:pp. 121–164 http://dx.doi.org/ 10.1007/978-3-642-76502-5_7. Cabrera Aguilera, M.V., Bastos da Fonseca, B., Ferris, T.K., Vidal, M.C.R., Carvalho, P.V.R.D., 2016. Modelling performance variabilities in oil spill response to improve system resilience. J. Loss Prev. Process Ind. 41. http://dx.doi.org/10.1016/j.jlp.2016.02.018.

85

Cardenas, I.C., Halman, J.I.M., 2016. Coping with uncertainty in environmental impact assessments: open techniques. Environ. Impact Assess. Rev. 60:24–39. http://dx.doi. org/10.1016/j.eiar.2016.02.006. Clay-Williams, R., Hounsgaard, J., Hollnagel, E., 2015. Where the rubber meets the road: using FRAM to align work-as-imagined with work-as-done when implementing clinical guidelines. Implement. Sci. 10:125. http://dx.doi.org/10. 1186/s13012-015-0317-y. De Carvalho, P.V.R., 2011. The use of Functional Resonance Analysis Method (FRAM) in a mid-air collision to understand some characteristics of the air traffic management system resilience. Reliab. Eng. Syst. Saf. 96:1482–1498. http://dx.doi.org/10.1016/j. ress.2011.05.009. EU Commission, 2012. 2012/135/EU: Commission Implementing Decision of 28 February 2012 establishing the best available techniques (BAT) conclusions under Directive 2010/75/EU of the European Parliament and of the Council on industrial emissiosn for iron and steel production. Off. J. Eur. Union 63–98. EUROCONTROL, 2009. A White Paper on Resilience Engineering for ATM 1–16. Harris, P.J., Harris, E., Thompson, S., Harris-Roxas, B., Kemp, L., 2009. Human health and wellbeing in environmental impact assessment in New South Wales, Australia: auditing health impacts within environmental assessments of major projects. Environ. Impact Assess. Rev. 29:310–318. http://dx.doi.org/10.1016/j.eiar.2009.02.002. He, G., Yang, J., Lu, Y., Wang, S., Chen, B., Hayat, T., Alsaedi, A., Ahmad, B., 2015. Ternary emergetic environmental performance auditing of a typical industrial park in Beijing. J. Clean. Prod. http://dx.doi.org/10.1016/j.jclepro.2015.03.040. Herrera, I.A., Hollnagel, E., Håbrekke, S., 2010. Proposing safety performance indicators for helicopter offshore on the Norwegian Continental Shelf. PSAM 10 - Tenth Conf. Probabilistic Saf. Assess. Manag. Hollnagel, E., 2012. FRAM: The Functional Resonance Analysis Method: Modelling Complex Socio-technical Systems. Ashgate. Hollnagel, E., 2014. Safety-I and Safety-II (the Past and Future of Safety Management). Ashgate, Farnham, UK. Hollnagel, E., Woods, D.D., 1983. Cognitive systems engineering: new wine in new bottles. Int. J. Man. Mach. Stud. 18. ICC, 1991. An ICC Guide to Effective Environmental Auditing Paris (Fr). Josimovic, B., Petric, J., Milijic, S., 2014. The use of the Leopold matrix in carrying out the EIA for wind farms in Serbia. Energy Environ. Res. 4:43–54. http://dx.doi.org/10. 5539/eer.v4n1p43. Kaufman, J.J., Woodhead, R., 2006. Stimulating Innovation in Products and Services: With Function Analysis and Mapping. http://dx.doi.org/10.1002/0471773662. Knechel, W.R., 2007. The business risk audit: origins, obstacles, and opportunities. Acc. Organ. Soc. 32, 383–408. Leopold, L.B., Clarke, F.E., Hanshaw, B.B., Balsley, J.E., 1971. A Procedure for Evaluating Environmental Impact. United States Department of the Interior, Washington, DC. Leveson, N., 2004. A new accident model for engineering safer systems. Saf. Sci. http://dx. doi.org/10.1016/S0925-7535(03)00047-X. Lundblad, K., Speziali, J., 2008. FRAM as a risk assessment method for nuclear fuel transportation. Int. Conference Work. Saf. Maltby, J., 1995. Environmental Audit: theory and practices. Manag. Audit. J. 10:15–26. http://dx.doi.org/10.1108/02686909510147372. Melanson, A., Nadeau, S., 2016. Managing OHS in complex and unpredictable manufacturing systems: can FRAM bring agility? Advances in Ergonomics of Manufacturing: Managing the Enterprise of the Future 490:341–348. http://dx.doi.org/10.1007/9783-319-41697-7_30. Noble, B.F., Nwanekezie, K., 2016. Conceptualizing strategic environmental assessment: principles, approaches and research directions. Environ. Impact Assess. Rev. http:// dx.doi.org/10.1016/j.eiar.2016.03.005. Nouvel, D., Travadel, S., Hollnagel, E., 2007. Introduction of the concept of functional resonance in the analysis of a near-accident in aviation. 33rd ESReDA Seminar: Future Challenges of Accident Investigation, p. 9. Oliveira, J., Rodrigues, L.L., Craig, R., 2011. Risk-related disclosures by non-finance, companies: Portoguese practices and disclosure characteristics. Manag. Audit. J. 26, 817–839. Patriarca, R., Di Gravio, G., Costantino, F., 2016. Resilience Engineering for space missions' safety assessment. In: IAASS (Ed.), Proceedings of the 8th IAASS Conference “Safety First, Safety for All.”. IAASS, Melbourne (Florida), pp. 228–238. Patriarca, R., Di Gravio, G., Costantino, F., 2017. A Monte Carlo evolution of the Functional Resonance Analysis Method (FRAM) to assess performance variability in complex systems. Saf. Sci. 91:49–60. http://dx.doi.org/10.1016/j.ssci.2016.07.016. Pickup, L., Atkinson, S., Hollnagel, E., Bowie, P., Gray, S., Rawlinson, S., Forrester, K., 2017. Blood sampling - two sides to the story. Appl. Ergon. 59. http://dx.doi.org/10.1016/j. apergo.2016.08.027. Power, M.K., 2003. Auditing and the production of legitimacy. Organ. Soc. 28, 379–394. Praetorius, G., Graziano, A., Schröder-Hinrichs, J.-U., Baldauf, M., 2016. Fram in FSA—Introducing a function-based approach to the formal safety assessment framework. Adv. Intell. Syst. Comput. http://dx.doi.org/10.1007/978-3-319-41682-3_34. Ramachandra, T.V., Bachamanda, S., 2007. Environmental audit of municipal solid waste management. Int. J. Environ. Technol. Manag. 7:369–391. http://dx.doi.org/10.1504/ IJETM.2007.015152. Rao, T.B., Chonde, S.G., Bhosale, P.R., Jadhav, A.S., Raut, P.D., 2011. Environmental audit of sugar factory: a case study of Kumbhi Kasari Sugar Factory, Kuditre. Kolhapur. Univ. J. Environ. Res. Technol. 1, 51–57. Remus, R., Aguado Monsonet, M.A., Roudier, S., Delgado Sancho, L., 2013. Best Available Techniques (BAT) Reference Document for Iron and Steel Production. European Commission, Joint Research Centre, Luxembourg http://dx.doi.org/10.2791/97469. Rosa, L.V., Haddad, A.N., de Carvalho, P.V.R., 2015. Assessing risk in sustainable construction using the Functional Resonance Analysis Method (FRAM). Cogn. Tech. Work 17: 559–573. http://dx.doi.org/10.1007/s10111-015-0337-z.

86

R. Patriarca et al. / Environmental Impact Assessment Review 63 (2017) 72–86

Ross, D.T., 1985. Applications and extensions of SADT. Comput. (Long. Beach. Calif.) 18. http://dx.doi.org/10.1109/MC.1985.1662862. Rubio, S., Pérez-Bandito, D., 2009. Recent advances in environmental analysis. Anal. Chem. 81:4601–4622. http://dx.doi.org/10.1021/ac200921j. Ruiz-Padillo, A., Ruiz, D.P., Torija, A.J., Ramos-Ridao, Á., 2016. Selection of suitable alternatives to reduce the environmental impact of road traffic noise using a fuzzy multicriteria decision model. Environ. Impact Assess. Rev. 61:8–18. http://dx.doi.org/10. 1016/j.eiar.2016.06.003. Sawaragi, T., Horiguchi, Y., Hina, A., 2006. Safety analysis of systemic accidents triggered by performance deviation. 2006 SICE-ICASE International Joint Conference. IEEE: pp. 1778–1781 http://dx.doi.org/10.1109/SICE.2006.315635. Shirali, G., Ebrahipour, V., Mohammad Salahi, L., 2013. Proactive risk assessment to identify emergent risks using Functional Resonance Analysis Method (FRAM): a case study in an oil process unit. Iran Occup. Health 10, 33–46. Smith, S., Hull & Associates, I, 2003. Environmental Audits. In: Ohio Aggregates & Industrial Minerals Associations (OAIMA) (Ed.), Compliance Manual. OAIMA, pp. 155–172. Stahl, 2008. Statistisches Jahrbuch der Stahlindustrie 2009–2010. Stanton, N.A., 2006. Hierarchical task analysis: developments, applications, and extensions. Appl. Ergon. 37. http://dx.doi.org/10.1016/j.apergo.2005.06.003. Steen, R., Aven, T., 2011. A risk perspective suitable for resilience engineering. Saf. Sci. 49: 292–297. http://dx.doi.org/10.1016/j.ssci.2010.09.003. Thompson, D., Wilson, M.J., 1994. Environmental auditing: theory and applications. Environ. Manag. 18:605–615. http://dx.doi.org/10.1007/BF02400863. Tole, M.P., et al., 2009. Environmental Audit Report Olkaria III Geothermal Power Plant. Kilifi, Kenya.

Tomlinson, P., Atkinson, S.F., 1987. Environmental audits: a literature review. Environ. Monit. Assess. 8:239–261. http://dx.doi.org/10.1007/bf00404267. Toro, J., Duarte, O., Requena, I., Zamorano, M., 2012. Determining vulnerability importance in environmental impact assessment. The case of Colombia. Environ. Impact Assess. Rev. 32:107–117. http://dx.doi.org/10.1016/j.eiar.2011.06.005. UNEP, 1990. Environmental Auditing: Report of a United Nations Environment Programme/Industry and Environment (UNEP/IEO). Van Wortswinkel, L., Nijs, W., 2010. Iron and Steel - Technology Brief I02. Viegas, C.V., Bond, A., Duarte Ribeiro, J.L., Selig, P.M., 2013. A review of environmental monitoring and auditing in the context of risk: unveiling the extent of a confused relationship. J. Clean. Prod. 47:165–173. http://dx.doi.org/10.1016/j.jclepro.2012.12.041. Virag, P.E., Smith, L.C., 2006. System for managing Environmental Audit information. US 7,051,046 B2. Wathem, P., 1990. An introductory guide to EIA. In: Wathem, P. (Ed.), Environmental Impact Assessment Theory and Practice. Routledge, London, UK. Wessels, J.A., Retief, F., Morrison-Saunders, A., 2015. Appraising the value of independent EIA follow-up verifiers. Environ. Impact Assess. Rev. 50:178–189. http://dx.doi.org/ 10.1016/j.eiar.2014.10.004. Woltjer, R., 2008. Resilience assessment based on models of functional resonance. 3rd Symposium on Resilience Engineering, pp. 299–303. World Bank Group, 1998. Environmental Audits in industrial projects. Pollution Prevention and Abatement Handbook, pp. 1–4. Zheng, Z., Tian, J., Zhao, T., 2016. Refining operation guidelines with model-checkingaided FRAM to improve manufacturing processes: a case study for aeroengine blade forging. Cogn. Tech. Work 18. http://dx.doi.org/10.1007/s10111-016-0391-1.